Microsoft has deployed a multi-model agentic security scanner, codenamed MDASH, that uses more than 100 specialized AI agents to find, validate, and prioritize exploitable vulnerabilities in source code, according to a company announcement Tuesday. The system is now available in Microsoft Azure Government, with preview access granted to select US government customers and authorized partners. The rollout marks one of the first deployments of agentic AI security tools into regulated government environments.
The MDASH system operates through a network of specialized AI agents that examine code from different angles, with each agent focusing on specific vulnerability classes. Additional agents then assess the findings and discuss whether an identified issue is reachable and presents a real threat, while the system consolidates duplicate results before delivering a ranked list to security teams. Microsoft reports that MDASH achieved a score of 96.55 on the public CyberGym benchmark, which draws from real-world vulnerabilities. The company cautioned, however, that a static benchmark can't fully represent the ambiguity and complexity involved in discovering vulnerabilities in actual software. Engineering teams are already using MDASH across Windows, Azure, and identity systems as part of active security workflows rather than isolated testing, and validated findings can flow into Defender workflows, GitHub, and Azure DevOps for prioritization, validation, and remediation.
According to Microsoft, most conventional security scanning tools depend on known patterns to spot potential weaknesses. MDASH takes a different path by using AI agents to think through how code operates and assess whether a detected weakness can genuinely be exploited. The company says MDASH operates within Azure Government and relies on models available through the FedRAMP High-authorized Microsoft Foundry service, which allows an agency's source code and what the system learns about it to stay within a boundary already cleared for handling that data. A select group of security partners and Microsoft Intelligent Security Association members were participating in the MDASH preview to help shape the technology and speed up agentic AI vulnerability discovery.
For authorized partners with public-sector practices, MDASH could open conversations around vulnerability assessment, remediation, DevSecOps integration, compliance, and managed security services, the report notes. The opportunity may reach beyond deploying the technology itself, as customers could need help deciding which applications to scan first, interpreting and ranking findings, integrating results into existing security workflows, and converting identified vulnerabilities into remediation plans. Microsoft hasn't announced a dedicated MDASH partner services program, but its decision to include authorized partners in the Azure Government preview gives the channel an early role as the technology moves further into production environments. MDASH remains in preview for select government customers and authorized partners, so this isn't yet a broad channel offering, but the report concludes that as increasingly sophisticated AI security tools enter regulated environments, partners that can translate those capabilities into measurable security outcomes could have a new service opportunity to build around them. The shift from pattern-matching to reasoning-based vulnerability discovery may force security teams to rethink how they staff and structure their operations, especially as agents take on tasks that previously required deep human expertise.